topic Re: ISE 3.3 system certificate update in Network Access Control

ISE 3.3 system certificate update

MonkeyBear007 — Wed, 23 Jul 2025 13:57:08 GMT

ISE 3.3 system certificate update

We use public cert and what is recommended way to renewal cert has they are part of the deployment pri and secondary
they are not part of the PAN failover

does it matter if i gave it two of the common name of both ISE servers and upload to each ISE?
best practice to make it for each ISE server?

Re: ISE 3.3 system certificate update

Rob Ingram — Wed, 23 Jul 2025 14:04:16 GMT

@MonkeyBear007 what certificate usage do you refer to admin, eap, portal etc?

It's common to use the same certificate (wildcard or multi SAN) certificate on the ISE nodes for EAP and Portal usage.

https://community.cisco.com/t5/security-knowledge-base/how-to-implement-digital-certificates-in-ise/ta-p/3630897

Have a look at pages 31-37 https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2234.pdf

Re: ISE 3.3 system certificate update

MonkeyBear007 — Wed, 23 Jul 2025 14:50:42 GMT

We use it for Admin, EAP authentication and portal
I was thinking for ISE1 ISE1.domain.com for common for ISE1
subject alternative name: ISE1, ISE2, IP address and DSN server name and etc..
for ISE2 ISE2.domain.com for common for ISE2
subject name ISE1 and ISE2 and etc
subject alternative name: ISE1, ISE2, IP address and DSN server name and etc..

Re: ISE 3.3 system certificate update

Rob Ingram — Wed, 23 Jul 2025 14:56:27 GMT

@MonkeyBear007 did you look at the ciscolive presentation and under the scenario of using wildcard or multiSAN certificate?

Re: ISE 3.3 system certificate update

MonkeyBear007 — Wed, 23 Jul 2025 17:50:36 GMT

I did training and you can have problem using wild cards.
I don't security will like idea of wild card
I though you can use intune to force to trust a cert

Re: ISE 3.3 system certificate update

Rob Ingram — Wed, 23 Jul 2025 17:59:39 GMT

@MonkeyBear007 read the official cisco live presentation above, it explains a scenario where you may wish to use the same certificate (a wildcard or multi-SAN) on all of the PSNs if a client is authenticated by different PSN. The issue I refer to is specific to apple devices though, if it is not applicable to your environment then deploy individual certificates to each node.

Re: ISE 3.3 system certificate update

alison23taylor — Fri, 25 Jul 2025 11:51:56 GMT

Hello,
For ISE 3.3 public certificate renewal on a primary and secondary deployment, it is best practice to generate a separate Certificate Signing Request (CSR) for each ISE node. While you can include both ISE server common names as Subject Alternative Names (SANs) in a single certificate and upload it to both, creating individual certificates for each ISE server, each with its own FQDN as the Common Name (CN) and also including the other node's FQDN as a SAN (if desired for specific services), is generally recommended. This approach simplifies management, clearly identifies each node, and aligns with the principle of least privilege for certificates. Remember that changing the Admin certificate will require a service restart, but ISE 3.3 offers a "Scheduled Restart" feature to minimize disruption. Always back up your existing certificates and keys before performing renewals.

Re: ISE 3.3 system certificate update

MonkeyBear007 — Fri, 25 Jul 2025 15:48:48 GMT

thank you

Re: ISE 3.3 system certificate update

MonkeyBear007 — Mon, 28 Jul 2025 15:13:37 GMT

is it recommended to do the primary first than do secondary for the ISE cert?